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Abstract 

Let K — Q(ti, . . . , tk) and a,b,c £ K. We give a simple algorithm to 
find, if it exists, X, Y, Z in K, not all zero, for which aX 2 + bY 2 + cZ 2 — 0. 

1 Introduction 

Let K = Q(ti, . . . , ife) and a,b,c € K. Our goal is to find, if it exists, a solution 
X, Y, Z G A, not all zero, for which 

aX 2 + bY 2 + cZ 2 = 0. (1) 

We will use projective coordinates (X : Y : Z) G P 2 (K) to indicate that at least 
one of X, Y, Z G if must be non-zero, and that (sX : sF : sZ) will be identified 
with (X : Y : Z) for any nonzero s G A". 

The case fc = (A" = Q) was solved by Legendre, who gave a criterion (local- 
global principle for conies) to decide if a solution (X, Y, Z) G P 2 (Q) exists. He 
also gave an algorithm to find a solution. 

Legendre showed that a solution (X : Y : Z) G P 2 (Q) exists if and only 
if a so-called solubility certificate exists. The non-trivial part is to show that 
existence of this certificate implies the existence of a solution (X : Y : Z). 
We sketch a textbook proof, with an improvement given in CM98], because 
our algorithm will follow the same approach. Use the solubility certificate to 
construct a certain lattice L which has the property that aX 2 + bY 2 + cZ 2 = 
mod abc for every (X, Y, Z) G L, and use Minkowski's theorem to show that L 
contains a non-zero element (X,Y,Z) for which \a\X 2 + \b\Y 2 + \c\Z 2 < 2abc. 
If aX 2 + bY 2 + cZ 2 is not already 0, it must be ±abc, and a transformation 
yields new X, Y, Z for which aX 2 + bY 2 + cZ 2 = 0. Alternatively, in |CM98| it 
is shown that one can construct a lattice L' C L such that aX 2 + bY 2 + cZ 2 = 
mod 2abc for every (A, Y, Z) G V and moreover that this L' still contains a 



non-zero element (X,Y,Z) for which \a\X 2 + \b\Y 2 + \c\Z 2 < 2abc and hence 
aX 2 + bY 2 + cZ 2 = 0. Given a solubility certificate, one can quickly find such 
(X, Y, Z) with the | LLL82| lattice reduction algorithm and Lemma 2.7 in CR03 
(where an even faster algorithm was given as well) . 

In the proof of Theoremnwe will follow the same ideas for K = Q(ii, • • ■ , ife)- 
Although this involves additional notation, some details will be easier since the 
lattice arguments for k = simplify to linear algebra when k > 0. 



2 The solubility certificate 

If abc = then the problem is trivial (if for example a = then (1 : : 0) is 
a solution) . If k = and if a, 6, c have the same sign then there is no solution, 
not even over R. From now on we assume 

abc 7^ 0, and if k = then a, b, c do not all have the same sign. (2) 

After multiplying by denominators we may assume that 

, D f Z if At = , Q s 

a,b,ceR k :={ Q[h ^ ^ . ffc>0 (3) 

Let g = gcd(et, b), where gcd refers to the greatest common divisor in R^. If 
g =/= 1 then a, 6, c will be replaced by a/g, b/g, eg. The new conic is equivalent to 
the old conic under (X : Y : Z) i— > (X : Y : Z/g). The same is done for gcd(6, c) 
and gcd(c, a), after which we get 

gcd(a, b) = gcd(6, c) = gcd(c, a) = 1 (4) 

A non-trivial square is a square of a non-zero c? € that is not a unit (so 
d 2 ^ 1 if k = and d Q if > 0). If a, b or c is divisible by a non-trivial square 
then we can divide and obtain an equivalent conic. Thus, we may assume that 
a, b, c are not divisible by non-trivial squares, which because of 10} is equivalent 
to 

abc is not divisible by a non-trivial square. (5) 

Given equation l|TJl. the above describes Legendre's procedure to compute a 
reduced form of this equation, which means: 

Definition 1 An equation aX 2 + bY 2 + cZ 2 — is in reduced form if a, b, c 
satisfy assumptions Q>, ^ and 

In this paper, if k > 0, then the leading coefficient resp. degree of a polyno- 
mial refers to the leading coefficient resp. degree with respect to ifc. If k > then 
denote d a , db, d c S N as the degrees of a, b, c. Denote l a , lb, l c G Q[ti, • ■ ■ , tk-i] 
as the leading coefficients of o, 6, c. Set 

if k > and c? a = = d c mod 2 

1 otherwise 
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If a solution (X : Y : Z) G P 2 {K) of equation exists, then 

J case = 1, or , . 

\ l a x 2 + l b y 2 + l c z 2 = has a solution in P 2 (Q(ii, . . .,t k -i))- 

Proof: Assume k > 0. After scaling we may assume that X, Y, Z G -Rfe. Let d 
be the maximum of the degrees (always with respect to tk) of aX 2 , bY 2 , and 
cZ 2 . If the degree of aX 2 is d then let x be the leading coefficient of X, otherwise 
set x = 0. By doing the same for ?/ and z one finds a solution (x : y : z). □ 



Denote 

~ _ ( Z if fc = 

fe:_ l G(ti,...,tfc-i)[tfc] if A;>0 

Let Factors(a) denote the set of all irreducible p £ Rk that divide a, with the 
additional condition that p must be positive (and hence a prime number) when 
fc = 0, and p must be monic (leading coefficient 1) when fc > 0. Denote 

F p := R k /(p). 

Introduce a new variable T and let f a ,fb,fc G Rk[T] be the following polyno- 
mials 

/„ := bT 2 + c, f b := cT 2 + a, / c := aT 2 + b. 
For / G [T] , the image in F p [T] is denoted as / mod p. 

Definition 2 Let aX 2 + bY 2 + cZ 2 = be in reduced form (see Definition^). 
Then a solubility certificate is a list containing the following: 

For every p G Factors(a), a root of f a mod p in F p 
For every p G Factors(6), a root of fb mod p in F p 
For every p G Factors(c), a root of f c mod p in F p 
If case = 0, a reduced form plus solubility certificate for equation f3j) . 

Note that for k = 0, the standard definition is formulated differently, namely 
the roots are combined by Chinese remaindering. So the standard definition of 
a solubility certificate is a list of three integers fc a , fc&, fc c that satisfy f a mod a, 
fb mod 6, and f c mod c respectively. 

Lemma 1 Assume equation 0) is in reduced form and has a solution in P 2 (K). 
Then a solubility certificate exists. 

Proof: Let (X : Y : Z) be a solution. After scaling we may assume that 
X, Y, Z G Rk with gcd(A, Y, Z) = 1. For case = we have already shown that 
equation JBJ has a solution by considering the leading coefficients of X, Y, Z. 
So equation |JBJ has a solubility certificate by induction. The remainder of the 
proof is the same as for the fc = case, we include it for completeness since our 
notations are slightly different. 

Let p G Factors(a). Now = aX 2 + bY 2 + cZ 2 reduces to bY 2 + cZ 2 mod p. 
Since 6, c do not vanish mod p, it follows that Y, Z are either both zero or both 
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not zero, where Y, Z denote the images of Y, Z in ¥ p . The first case is ruled out 
since it would imply that bY 2 + cZ 2 and hence aX 2 would be divisible by p 2 , 
which implies that X is divisible by p, contradicting gcd(X, Y, Z) = 1. Thus, 
Y, Z are not zero. Then f a mod p has ±Y/Z £ F p as roots. Repeating this 
for fb resp. f c for the factors of b resp. c it follows that a solubility certificate 
exists. □ 



2.1 Algorithmic remarks 

To compute (if it exists) a solubility certificate we use: 

1. A factorization algorithm for Rk- 

2. A factorization algorithm for F p [T]. 

3. If case = we need items 1 and 2 for k — 1 as well. 

Such algorithms are available in several computer algebra systems. If k = 
then item 1 can take much time, while the time spent on item 2 is negligible in 
comparison. If k > 0, it is more or less the other way around. When k > the 
time spent on items 1 and 2 is polynomially bounded in terms of the degrees 
and logarithmic heights, provided that k is fixed. So for fixed fc, one can com- 
pute a solubility certificate in polynomial time except if case = at each of the 
stages fc,fc — 1, . . . , 2, 1 because then we need to factor in Rq = Z for which no 
polynomial time algorithm is known. Having to factor integers can sometimes, 
but not always, be avoided by interchanging variables. 

Remark. A solubility certificate corresponds to a subset of the conic. 

If equation |QJ has a solution in P 2 (K) then the number of solubility certificates 
equals 2™ for some integer n, because for each p, one has to choose one of the 
two roots (one root if p = 2). Every certificate corresponds to a non-empty (see 
Theorem ^| subset of the conic, where the word conic refers to the set of so- 
lutions of equation JJJ in P 2 (K). Grouping together those subsets/certificates 
that correspond under (X : Y : Z) (±A : ±Y : ±Z), one writes the conic as 
a disjoint union of non-empty subsets Si, S2, ■ ■ ■ , £2™ for some integer m > 0. 
Given one point on the conic, one can write down a parametrization, a birational 
map \& from P l (K) to the conic. Then every point on the conic can be written 
as ^>(u : v) for some (u : v) £ P 1 ^). Nevertheless, one can construct examples 
with fc = 0, m > 0, with a point in one Si given, where it would require a 
breakthrough in integer factorization to find a point in any Sj with j ^ i. This 
is because going from one Si to another is equivalent to finding a non-trivial 
factor of a, b or c. 

Although the above remark is not needed for our algorithm, it is useful 
to know that a solubility certificate corresponds to a subset of the conic, and 
that the algorithm in the next section finds an element of that subset. So any 
certificate will lead to a point on the conic, however, a much nicer point (smaller 
degrees or heights) might be found by trying 2 m certificates. 
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3 Finding a point on the conic 



Let K = Q(ti, . . . , tk) where ti, . . . , t/. are variables and k £ N. 
Algorithm FindPoint 

Input: k, t\ tk, a,b,c £ K satisfying assumptions (I2I3I4I5I) . and a 

solubility certificate. 
Output: A solution (X : Y : Z) £ P 2 (K) of aX 2 + bY 2 + cZ 2 = 0. 

1. If k = then use Algorithm II or III in CR03 and stop. 

2. Let d a , db, d c be the degrees (with respect to tk) of a, b, c. 

3. If d a = db = d c mod 2 then case := 0, otherwise case := 1 and E := 0. 

4. Let A, B, C be: 

d b + d c d c + d a d a + d b 

— case, — case, — case 

2 2 2 

and set 

ABC 

X:=2jXi^, y := } Yjt l k , Z :=2^Zib\ 

i=0 i=0 i=0 

where the Xi, Yi, Zi are new variables. 

5. If case = 0, let l a ,h,lc £ Q[ti, ■ ■ ■ ,tk-i] be the leading coefficients of 
a, 6, c. Let (x : y : z) be a solution of equation ©, see the Remark below. 
Introduce a new variable w and set := {Xa — xw, Yb — yw, Zq — zw}. 

6. For every p £ Factors(a), let a £ F p be a root of f a mod p. Lift a to 

divide Y — aZ by p and let r be the remainder. Write r = X^-cd^fc 
where d is the degree of p. Then rj is a Q(ti, . . . , ife_i)-lincar combination 
of Yj's and Zj's. Now set E := E[j{ro, . . . , rd_i}. 
Repeat this for fa resp. f c for all p in Factors(6) resp. Factors(c). 

7. Equate all elements of E to 0, resulting in a system of homogeneous linear 
equations for the variables X i} Y i7 Zi (and w if case = 0). Solve this system 
and substitute the general solution into X, Y, Z. Multiply (X, Y, Z) by the 
least common multiple of the denominators of X, Y, Z. Then divide by 
gcd(A, F, Z). Return (X :Y : Z) and stop. 

Remark on step [5J For the algorithm it is more convenient to replace "a 
reduced form and a solubility certificate for equation |JBJ" in Definition by 
"a solution (x : y : z) of Induction resp. recursion shows that this is 

mathematically resp. algorithmically equivalent. 

Theorem 1 Assume equation 0) is in reduced form. Then it has a solution in 
P 2 {K) if and only if a solubility certificate exists. 
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Proof: If k = then this is Legendre's theorem. Assume we have a solubility 
certificate and that k > 0. It suffices to prove that Algorithm FindPoint works. 
For step see the Remark above. The general solution of system E in step [7] 
is not zero because the number of variables is the number of equations plus 1 . 
Therefore, the notation (X : Y : Z) in step [7| is correct, that is, X, Y, Z are 
not all zero. Let D be the degree of abc. By construction, aX 2 + bY 2 + cZ 2 
has degree < max{c? Q + 2A, db + 2B, d c + 2C} = D — case. Furthermore, it is 
divisible by every p in Factors(a), Factors(&) and Factors(c) because equations E 
are satisfied. Then assumption (J5J from section |21 implies that aX 2 + bY 2 + cZ 2 
is divisible by abc hence it can be written as s ■ abc for some s. Comparing 
degrees, it follows that s — when case = 1. If case = 0, then the tP coefficient 
in aX 2 + bY 2 + cZ 2 is (see step [5J w 2 times the left-hand side of equation ©, 
which equals 0. It follows that aX 2 + bY 2 + cZ 2 = 0. 

The free variable (s) in the general solution of E will disappear in step 
when we divide by gcd(X, Y, Z) because the conic does not contain any lines (it 
is non-degenerate by assumption @). So the solution of equation (JIJ returned 
by the algorithm will be an element of P 2 (K) . □ 

4 Algorithmic details 

Let K = Q(ti, . . . , tk) where ti, . . . , tj. are variables and k S N. 
Algorithm ReduceConic 

Input: k, t%, . . . , tk, a,b,c S K satisfying assumption 

Output: ai, bi, c\ for which a\X 2 + b\Y 2 + c\Z 2 = is the reduced form of (JTJ- 

1. Multiply (a, 6, c) by the least common multiple of the denominators. 

2. g := gcd(a, b). Set a := a/g, b :— b/g, c :— eg, and store g. 

3. g := gcd(6, c). Set b :— b/g, c :— c/g, a :— ag, and store g. 

4. g := gcd(c, a). Set c := c/g, a := a/g, b := bg, and store g. 

5. If k = then let A, B, C be the absolute values of a, b, c and do 

(a) Compute all prime factors of A that can be calculated reasonably 
quickly; this includes all small prime factors, as well as A itself if A 
is prime (note that rigorous primality proofs are not needed because 
correctness of the parts of the algorithm that use primality can be 
verified afterwards). Storing the g's in previous steps may help; a 
partial factorization of A may already be known. If any prime factors 
were found, store them, divide A by them, and repeat. 

(b) Now A no longer contains easily computable prime factors, which 
implies that A is not a prime. Check if A is a square. If so, store the 
square root. Otherwise, apply a factorization algorithm to A that 
finds at least one non-trivial factor and go back to the previous step. 
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(c) At this stage enough information has been computed to write a = 
aia| where a\, <Z2 are integers, a\ is square-free, and the factorization 
of a\ (but in general not 02) is known. 

(d) Apply the same process to B and C. 

6. If k > then apply square-free factorization to write a as a\a\ for some 
a\ , a,2 6 Rk with a± square-free. Now factor a± in Rk . Note that the 
contents of a\ (the largest r E Q for which ai/r g will usually be an 
integer. This integer does not need to be square- free and should not be 
factored. Apply the same process to b and c. 

7. Return a l5 b\, C\ and stop. 

If k = 0, each time a prime p dividing A is found, we can check if f a can be 
factored mod p, since if it remains irreducible, then the conic has no points over 
Q and so there is no reason to continue. Apart from the output, one also needs 
to store <Z2,&2 5 C2 and the g's from steps 2, 3, 4 since this information is needed 
to map solutions of the reduced equation to solutions of the original equation. 

Algorithm Conic 

Input: fc, ti,...,tk, a,b,c e K. 

Output: A solution (X : Y : Z) g P 2 (K) of equation if such solution exists. 

1. If a = then return (1:0:0) and stop. 
If b — then return (0:1:0) and stop. 
If c = then return (0:0: 1) and stop. 

2. If k = and a, b, c have the same sign then return "no solution exists" 
and stop. 

3. Replace a, b, c by the output of Algorithm ReduceConic, and determine 
from the stored information a map <p that maps solutions of the reduced 
equation to solutions of the original equation. 

4. Compute a solubility certificate: 

(a) For each p in the factors of a resp. b resp. c, factor the image of f a 
resp. fb resp. f c in F P [T]. If irreducible, then return "no solution 
exists" and stop. Otherwise, store one of the roots (this root will be 
used in step|Hlof Algorithm FindPoint). 

(b) If case = then, instead of computing a solubility certificate for 
equation ©, apply Algorithm Conic to find a solution (x : y : z) 
of (jSJ . If this recursive call returned "no solution exists" then return 
the same message and stop. 

5. Let (X : Y : Z) be the output of Algorithm FindPoint. 

6. Return <fi(X :Y:Z) and stop. 
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If F is a field for which the necessary ingredients are available (an implemen- 
tation to solve a conic over F, and the factorization algorithms mentioned in 
section l!rT|l then F(ti, . . . , *&) can be handled as well. If a conic implementation 
over F is not available, Algorithm Conic in this paper could still be useful since 
it would still work when case = 1, k > 0. 

5 Examples 

An implementation in Maple is available at 

http : //www .math . f su . edu/~hoeij/f iles/ConicProgram 

Example 1. 

Leta:=l, b := 2t\ + 2*i* 2 -*?, and c := — 3t| - 4*i*| + 8tft| + 16*?t 2 - 48tf. 

The implementation does not always find the same solution, see the remarks at 
the end of section \l. II As output, one encounters for example 

(*2 + + 4 *i*2 — 4*| : tl-tt\ : * 2 ) 

but also 

(*| + 2*|t 2 + 8*? : *J + 2*i* 2 - 4t? : * 2 +*i)- 

Example 2. 

a := *? + 1, 6 := -(*? + 1)*| + (4*? + 4)* 2 - 1, c := (2*? - lOtj + 2*i - 9)4 
-(6*f + 6*i - 2)t| + (*f - 8*? - 2*2 - 6*i - 2)*2 - (4*f + 2*f - 2* x - 2)* 2 - 1. 
The implementation may find 

(*|-*^+* 2 -l : t 2 2 +t 2 +h : 1) 

but may also find a more complicated solution, depending on which solubility 
certificate it chose. 
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